fix(saude): never reuse or publish a partial CKAN download

[devgtv]

Summary

download_resource() short-circuits on dest_path.exists() but streamed directly into that path:

if dest_path.exists() and not overwrite:
    return dest_path
...
with dest_path.open("wb") as fh:      # truncated file survives a mid-stream drop
    async for chunk in response.aiter_bytes(...):
        fh.write(chunk)

The sync retry loop could not recover from this. _download_raw_with_retry names its temp file <uuid8>-<basename>, but CKAN/Saude ignores the requested filename and writes filename_for(resource, ...) inside output.parent — as _download_once's own docstring states:

Some origins (e.g. CKAN/Saude resources) ignore the requested filename and write to their own derived name in output.parent

So the retry's self._cleanup_local(output) deleted a path that never existed, and download_resource then immediately returned the truncated file. The engine hashed it, converted it, and uploaded it to S3 as the official artifact.

A second, related hazard: all Saude workers share management/tmp as dest_dir, and filename_for derives the name purely from resource.name. Two packages publishing a resource with the same name resolve to the same dest_path, and two concurrent workers interleave open("wb") writes into one file.

Fix

download_resource() streams into a sibling .<name>.<uuid8>.part file and os.replace()s it on success, unlinking it on any BaseException. The rename is atomic, so concurrent writers can no longer interleave.

_download_raw_with_retry() gives each attempt its own scratch directory and removes the whole directory on retry — the only reliable cleanup when the origin chose the filename itself. No directory is created for the final attempt, so nothing is left behind. _cleanup_stale_tmp() also sweeps these directories (recognised by the new _is_attempt_dir(): 8 hex chars, which nothing else in that tmp area uses), so a killed run does not leak them into the next one.

Tests

test_download.py — new _FlakyTransport yields real bytes and then raises ReadError, so the failure happens after the destination has been written to:

• failure mid-stream leaves no file and no .part scratch
• a retry after a failure downloads the full content (previously returned the partial file)
• an HTTP error leaves no file
• a complete download leaves no scratch file

test_sync_more.py — new TestDownloadRawWithRetry:

• a failed attempt does not leak the origin-derived file across retries, and each attempt gets a distinct directory
• a successful retry returns the fresh path with complete bytes
• _is_attempt_dir accepts only hex-8 names
• _cleanup_stale_tmp sweeps leftover attempt directories

Verified the two download tests fail against the previous code.

• 1741 passed, 6 skipped
• black and isort clean